CVE-2021-42550 Vulnerable logback version 1.2.10 in SonarQube Community 9.9 LTS

SonarQube Server / Community Build
,
1

Hello,

Similar to this previous issue there’s a new vulnerability on the logback-core, this time affecting the version 9.9 LTS:

CVE Website

The logack-core version used by the LTS release is the 1.2.10 and the one that resolves the vulnerability is the 1.5.13.

There’s any plan to resolve it on the LTS version or it’s also an assumable risk?

Thanks in advance,
Sergi.

2

Hey there,

I’ve unlisted your topic since you’re reporting a vulnerability. Our responsible disclosure policy asks that you email security@sonarsource.com rather than making public posts. Could you please re-send this to security@sonarsource.com?

Thanks!